Perform systematic alert triage in Elastic Security SIEM—classifying, prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security detections, prioritizing an analyst's alert queue, or investigating alerts during SOC operations.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siemnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-alert-triage-with-elastic-siemgh skill install mukul975/Anthropic-Cybersecurity-Skills performing-alert-triage-with-elastic-siemgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-alert-triage-with-elastic-siem ~/.claude/skills/performing-alert-triage-with-elastic-siem # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-alert-triage-with-elastic-siem ~/.agents/skills/performing-alert-triage-with-elastic-siem # Codex, Cursor, Gemini CLI, Copilot, OpenCode